Memory forensics · quantitative schema · downstream analytics
This report documents VolMemLyzer's feature-extraction layer separately from its analyst-facing triage rules. The feature schema preserves image-level measurements for statistical analysis and machine-learning pipelines while keeping the underlying forensic artifacts available for explanation and review.
Separation of concerns
Ask whether an object satisfies an investigative hypothesis and should be surfaced for review. They use explicit conditions, evidence families and bounded scoring.
Asks what measurable property of the memory image should be preserved for downstream statistics or modelling. A feature value is not automatically a detection.
Feature pipeline
Schema landscape
The circle below encodes all 520 documented features by group size. Hover for counts; click a segment to filter the searchable catalog to that group. The largest groups are also ranked at right.
The ring shows schema breadth, not security importance. A larger group simply exposes more measurements.
Coverage domains
pslist, psscan, pstree, psxview, command lines, privileges and environment-derived measurements.
VAD structure, private executable memory and malfind-derived aggregates.
Loaded modules, module scans, drivers, callbacks, IRP and kernel-oriented state.
Connection/socket state, address/port distributions and image-level network summaries.
Registry, Amcache, services, execution-history and related persistent-state measurements.
Handles, pools, mutants, symlinks, timers, windows/stations and other structural measurements.
Interactive catalog
The table below is populated directly from FEATURES.md when loaded. Group names come from its section headings, while feature semantics come from the Markdown tables. This page is a view of the canonical schema, not a parallel copy.
| Feature | Group | Type | Domain | Unit | Description / interpretation |
|---|---|---|---|---|---|
| Loading… | |||||
Direct links such as #registry, #vadinfo or #handles filter the catalog automatically. If a local browser blocks the live fetch, use the canonical schema; GitHub Pages can load it normally.
How to read a feature
amcache.nonMicrosoftRatio
Stable schema identifier.
Type, expected domain and unit distinguish counts, ratios, timestamps, entropy and memory-size measurements.
Many values require a host-class baseline. “Higher” or “rarer” is not automatically “malicious.”
Missing data
The relevant artifact was successfully produced and the extractor measured a zero-valued quantity.
The upstream plugin failed or did not produce usable evidence. VolMemLyzer records the failed plugin rather than silently converting absence into a benign value.
This distinction is essential for statistical validity. Treating collection failure as a real zero contaminates both descriptive analysis and model training.
Downstream integration
| Concept | Stable target |
|---|---|
| Complete feature system | features.html |
| Registry features | features.html#registry |
| VAD features | features.html#vadinfo |
| Handle features | features.html#handles |
| Network features | features.html#netscan |
| Analysis rules | index.html#rules |
| Scheduler | index.html#scheduler |
This is the pattern MemTriage should use: explain what MemTriage does, then link here when the reader wants the extraction schema or VolMemLyzer execution details.
Reproducibility
Feature definitions remain version-controlled in FEATURES.md; extractor implementations remain in the VolMemLyzer source tree. The browser report exists to make the schema searchable, visual and linkable.